Privacy Policy

Advanced AI Check Out Rules · Last updated: 19 October 2026

This Privacy Policy explains how Two Dollar (“we”, “us”) collects, uses, stores and shares information when a merchant installs and uses Advanced AI Check Out Rules (the “App”) on a Shopify store, and when a shopper visits that store’s cart or checkout while the App is active.

In short: we store the rules a merchant configures and basic, non-identifying records of when a rule blocked a cart. We do not collect shoppers’ names, email addresses, phone numbers, postal addresses or payment details, and we do not sell personal information.

1. What the App does

The App lets merchants define purchase rules (for example minimum or maximum quantities and order amounts, optionally limited to certain shopper groups, countries or times) and enforces them in the cart and at checkout. It also offers optional AI-assisted features that help merchants draft and review rules.

2. Information we collect

2.1 From merchants (the store owner and staff)

• Store and installation data: your .myshopify.com domain, the access token and granted permission scopes that Shopify issues when you install the App, and the details of the staff account that Shopify shares with us during sign-in (such as name, email and locale), if any.
• Configuration you create: rules, rule profiles and their conditions, targeted products, variants, collections and shipping zones, custom error messages, detected rule conflicts, and onboarding tutorial progress.
• Billing records: your plan, subscription status and identifier, amounts, currency, billing period and invoice numbers. Payment is handled entirely by Shopify; we never see your card or bank details.
• AI usage records: the AI credit balance for your store and a log of each AI operation (type of operation, points used, provider and token counts).

2.2 From the Shopify Admin API

With your permission we read data from your store so the App can work: products, variants and collections (to target rules), shipping zones (for region conditions), customer segments, customer tags and B2B companies (to build shopper-group conditions). To make shopper-group conditions work at checkout, the App also adds and removes a Shopify customer tag (with the prefix td_seg_) on customers who belong to a segment you chose to use. We keep only a record of which segments are synchronised and how many customers they contain; we do not copy customer profiles into our own database.

2.3 From shoppers at cart and checkout

Rules are evaluated by code that runs on Shopify’s infrastructure and in the shopper’s browser. When a rule blocks or flags a cart, the App sends a short event to our server so the merchant can see which rules fire. The event contains only:

• the store domain and the identifier of the rule or profile that triggered;
• the cart total, number of items and currency;
• the names, variants, prices and quantities of the products in the cart;
• the error message shown to the shopper;
• a coarse shopper group label and the shopper’s country code;
• a random session identifier generated in the shopper’s browser (kept in sessionStorage for the browser tab only) so that the same event is not counted twice. It is not linked to a person and is not a cookie.

We do not collect shoppers’ names, email addresses, phone numbers, delivery or billing addresses, payment information or order numbers, and the App does not track shoppers across websites.

2.4 Technical data

Like most web services, our servers receive the IP address and browser details of every request and keep standard server logs for security, debugging and abuse prevention. IP addresses are also used briefly in memory to rate-limit requests. The pages of the App load Cloudflare Web Analytics, a cookie-less service that reports aggregate page-load and performance statistics.

3. How we use information

• to provide, operate and secure the App and enforce the merchant’s rules;
• to show merchants analytics, such as blocked-cart counts and rule performance;
• to run optional AI features (see section 5);
• to manage plans, trials, AI credits, billing and invoices;
• to respond to support requests, fix bugs and prevent fraud or abuse;
• to comply with legal obligations, including Shopify’s data-protection requirements.

We do not use this information for advertising and we do not sell it.

4. Who we share information with

We share information only with service providers that help us run the App, and only as needed:

Provider	Purpose	Information involved
Shopify	Platform, authentication, billing, Admin API	Store data described in section 2
Google (Gemini) and OpenAI	Optional AI-assisted rule features	The context described in section 5
Cloudflare	Web analytics and network delivery	Page-load statistics and request metadata such as IP address
Our hosting and database providers	Running the servers that store the App’s data	All data held by the App

We may also disclose information when required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition or sale of assets (in which case we will require the new owner to honour this policy).

5. AI-assisted features

If a merchant uses the AI features, the App sends the text the merchant typed together with the context needed to answer, such as the store type, the names and settings of existing rules, and aggregate rule statistics, to Google Gemini or OpenAI to generate suggestions. Merchants should not type personal information about individuals into AI prompts. We do not send shoppers’ data to AI providers. AI output is a suggestion only; the merchant decides whether to apply it.

6. How long we keep information

We keep a store’s data while the App is installed. When a merchant uninstalls the App, we immediately delete the stored access token and sessions. Shopify then sends us a store-erasure request about 48 hours later, and we delete all remaining data for that store, including rules, profiles, analytics events, billing and AI usage records. Copies in routine backups are removed as those backups are rotated. We also act on Shopify’s shopper data-request and shopper-erasure requests (see section 7).

7. Your rights

Depending on where you live (for example under the EU/UK GDPR, the California CCPA/CPRA or Indonesia’s Personal Data Protection Law), you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to lodge a complaint with a data-protection authority.

• Merchants: contact us at the address in section 11. Uninstalling the App starts deletion of your data as described in section 6.
• Shoppers: the merchant whose store you bought from is the controller of your personal data and we act on their behalf. Because the App does not store your name, email, phone or address, we generally hold nothing that identifies you. Please send requests to the store; the store can forward them to us through Shopify, and we process Shopify’s customers/data_request and customers/redact requests automatically.

8. Security

We use industry-standard safeguards, including encrypted HTTPS connections, access controls on our servers and database, validation of requests from Shopify, and rate limiting of public endpoints. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a breach affecting personal information, we will notify affected merchants and authorities as required by law.

9. International transfers

We and our service providers may process information in countries other than the one where you live, which may have different data-protection laws. Where the law requires it, we put appropriate safeguards in place for such transfers.

10. Children

The App is a business tool for merchants and is not directed to children. We do not knowingly collect personal information from children.

11. Contact us

Questions, requests or complaints about this policy or your data: checkout@twodollar.app

12. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows the latest revision. If we make material changes, we will give merchants reasonable notice, for example inside the App or by email.